BETA


Events

2024/03/12
   EP - Text adopted by Parliament, 1st reading/single reading
Documents
2024/03/12
   EP - Decision by Parliament, 1st reading
Documents
2024/03/11
   EP - Debate in Parliament
2024/01/23
   EP - Approval in committee of the text agreed at 1st reading interinstitutional negotiations
Documents
2023/12/20
   CSL - Coreper letter confirming interinstitutional agreement
2023/12/20
   EP - Text agreed during interinstitutional negotiations
Documents
2023/09/13
   EP - Committee decision to enter into interinstitutional negotiations confirmed by plenary (Rule 71)
2023/09/11
   EP - Committee decision to enter into interinstitutional negotiations announced in plenary (Rule 71)
2023/07/27
   EP - Committee report tabled for plenary, 1st reading
Details

The Committee on Industry, Research and Energy adopted the report by Nicola DANTI (Renew, IT) on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020.

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

Security updates

The amended text stated that manufacturers should ensure, where technically feasible, that products with digital elements clearly differentiate between security and functionality updates. Security updates, designed to decrease the level of risk or to remedy potential vulnerabilities, should be installed automatically , in particular in the case of consumer products.

Enhancing skills in a cyber resilient digital environment

Members stressed the importance of professional skills in the cybersecurity field, proposing education and training programmes, collaboration initiatives, and strategies for enhancing workforce mobility.

Point of single contact for users

In order to facilitate reporting on the security of products , manufacturers should designate a point of single contact to enable users to communicate directly and rapidly with them, where applicable by electronic means and in a user-friendly manner, including by allowing users of the product to choose the means of communication, which should not solely rely on automated tools.

Manufacturers should make public the information necessary for the end users to easily identify and communicate with their points of single contact.

Guidelines

The amended text included provisions for the Commission to issue guidelines to create clarity, certainty for, and consistency among the practices of economic operators. The Commission should focus on how to facilitate compliance by microenterprises, small enterprises and medium-sized enterprises.

Conformity assessment procedures for products with digital elements

Harmonised standards, common specifications or European cybersecurity certification schemes should be in place for six months before the conformity assessment procedure applies.

Mutual recognition agreements (MRAs)

To promote international trade, the Commission should endeavour to conclude Mutual Recognition Agreements (MRAs) with third countries. The Union should establish MRAs only with third countries that are on a comparable level of technical development and have a

compatible approach concerning conformity assessment. The MRAs should ensure the same level of protection as that provided for by this Regulation.

Procedure at EU level concerning products with digital elements presenting a significant cybersecurity risk

Where the Commission has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of non-technical risk factors, Members considered that it should inform the relevant market surveillance authorities and issue targeted recommendations to economic operators aimed at ensuring that appropriate corrective actions are put in place.

Revenues generated from penalties

The revenues generated from the payments of penalties should be used to strengthen the level of cybersecurity within the Union, including by developing capacity and skills related to cybersecurity, improving economic operators' cyber resilience, in particular of microenterprises and of small and medium-sized enterprises and more in general fostering public awareness of cyber security issues.

Evaluation and review

Every year when presenting the Draft Budget for the following year, the Commission should submit a detailed assessment of ENISA's tasks under this Regulation as set out in Annex VIa and other relevant Union law and shall detail the financial and human resources needed to fulfil those tasks.

Documents
2023/07/19
   EP - Vote in committee, 1st reading
2023/07/19
   EP - Committee decision to open interinstitutional negotiations with report adopted in committee
2023/06/30
   EP - Committee opinion
Documents
2023/05/23
   NL_SENATE - Contribution
Documents
2023/05/03
   EP - Amendments tabled in committee
Documents
2023/05/03
   EP - Amendments tabled in committee
Documents
2023/04/20
   EP - Referral to associated committees announced in Parliament
2023/03/31
   EP - Committee draft report
Documents
2022/12/21
   PT_PARLIAMENT - Contribution
Documents
2022/12/19
   BG_PARLIAMENT - Contribution
Documents
2022/12/16
   EP - LØKKEGAARD Morten (Renew) appointed as rapporteur in IMCO
2022/12/14
   ESC - Economic and Social Committee: opinion, report
Documents
2022/11/14
   CZ_CHAMBER - Contribution
Documents
2022/11/09
   EDPS - Document attached to the procedure
2022/11/09
   EP - Committee referral announced in Parliament, 1st reading
2022/10/26
   EP - DANTI Nicola (Renew) appointed as rapporteur in ITRE
2022/09/15
   EC - Document attached to the procedure
2022/09/15
   EC - Document attached to the procedure
Documents
2022/09/15
   EC - Document attached to the procedure
2022/09/15
   EC - Legislative proposal published
Details

PURPOSE: to lay down a horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of EUR 5.5 trillion by 2021. Such products suffer from two major problems adding costs for users and the society: (i) a low level of cybersecurity , reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and (ii) an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner. In a connected environment, a cybersecurity incident in one product can affect an entire organisation or a whole supply chain, often propagating across the borders of the internal market within a matter of minutes. This can lead to severe disruption of economic and social activities or even become life threatening.

While the existing Union legislation applies to certain products with digital elements, there is no horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements. It is therefore necessary to lay down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market.

CONTENT: with this proposal, the Commission seeks to lay down horizontal cybersecurity rules which are not specific to sectors or certain products with digital elements.

Subject matter

Based on the new legislative framework for product legislation in the EU, the proposal establishes:

- rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products;

- essential requirements for the design, development and production of products with digital elements, and obligations for economic operators in relation to these products with respect to cybersecurity;

- essential requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the whole life cycle, and obligations for economic operators in relation to these processes;

- rules on market surveillance and enforcement of the above-mentioned rules and requirements.

Scope

The draft Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. It will not apply to products for which cybersecurity requirements are already set out in existing EU rules, for example on medical devices, aviation or cars .

Objectives

It has two main objectives aiming to ensure the proper functioning of the internal market:

- create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle;

- create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements.

Obligations for manufacturers, importers and distributors

Obligations would be set up for economic operators, starting from manufacturers, up to distributors and importers, in relation to the placement on the market of products with digital elements, as adequate for their role and responsibilities on the supply chain.

The essential cybersecurity requirements and obligations mandate that all products with digital elements shall only be made available on the market if, where dully supplied, properly installed, maintained and used for their intended purpose or under conditions, which can be reasonably foreseen, they meet the essential cybersecurity requirements set out in this draft Regulation.

The essential requirements and obligations would mandate manufacturers to factor in cybersecurity in the design and development and production of the products with digital elements, exercise due diligence on security aspects when designing and developing their products, be transparent on cybersecurity aspects that need to be made known to customers, ensure security support (updates) in a proportionate way, and comply with vulnerability handling requirements.

Notification of conformity assessment bodies

Proper functioning of notified bodies is crucial for ensuring a high level of cybersecurity and for the confidence of all interested parties. Therefore, the proposal sets out requirements for national authorities responsible for conformity assessment bodies (notified bodies). Member States will designate a notifying authority that will be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies.

Conformity assessment process

Manufacturers should undergo a process of conformity assessment to demonstrate whether the specified requirements relating to a product have been fulfilled. Where compliance of the product with the applicable requirements has been demonstrated, manufacturers and developers would draw up an EU declaration of conformity and will be able to affix the CE marking.

Market surveillance

Member States should appoint market surveillance authorities , which would be responsible for enforcing the Cyber Resilience Act obligations.

In case of non-compliance, market surveillance authorities could require operators to bring the non-compliance to an end and eliminate the risk, to prohibit or restrict the making available of a product on the market, or to order that the product is withdrawn or recalled. Each of these authorities will be able to fine companies that don't adhere to the rules.

Application

To allow manufacturers, notified bodies and Member States time to adapt to the new requirements, the proposed Regulation will become applicable 24 months after its entry into force, except for the reporting obligation on manufacturers, which would apply from 12 months after the date of entry into force.

Documents

Votes

Exigences horizontales de cybersécurité pour les produits comportant des éléments numériques et modification du règlement (UE) 2019/1020 - Horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020 - Horizontale Cybersicherheitsanforderungen für Produkte mit digitalen Elementen und Änderung der Verordnung (EU) 2019/1020 - A9-0253/2023 - Nicola Danti - Accord provisoire - Am 2 #

2024/03/12 Outcome: +: 517, 0: 78, -: 12
DE FR IT PL ES NL RO SE HU BE BG CZ PT AT EL HR DK SK FI IE LT SI LV EE LU MT CY
Total
84
72
62
45
55
28
21
19
17
19
16
19
19
17
16
12
11
13
10
13
8
7
7
7
5
4
1
icon: PPE PPE
152

Hungary PPE

1

Denmark PPE

For (1)

1

Finland PPE

2

Slovenia PPE

3

Estonia PPE

For (1)

1

Luxembourg PPE

For (1)

1

Malta PPE

For (1)

1
icon: S&D S&D
127

Belgium S&D

2

Czechia S&D

For (1)

1

Greece S&D

1

Slovakia S&D

For (1)

1

Lithuania S&D

2

Slovenia S&D

2

Latvia S&D

2

Estonia S&D

2

Luxembourg S&D

For (1)

1

Cyprus S&D

1
icon: Renew Renew
87

Poland Renew

1
3

Hungary Renew

2

Belgium Renew

2

Austria Renew

For (1)

1

Greece Renew

1

Croatia Renew

For (1)

1

Finland Renew

2

Ireland Renew

2

Lithuania Renew

1

Slovenia Renew

2

Latvia Renew

For (1)

1

Estonia Renew

3

Luxembourg Renew

2
icon: Verts/ALE Verts/ALE
65

Italy Verts/ALE

3

Poland Verts/ALE

For (1)

1

Spain Verts/ALE

3

Netherlands Verts/ALE

3

Sweden Verts/ALE

2

Belgium Verts/ALE

3

Czechia Verts/ALE

3

Portugal Verts/ALE

1

Austria Verts/ALE

2

Greece Verts/ALE

For (1)

1

Denmark Verts/ALE

For (1)

1

Finland Verts/ALE

2

Ireland Verts/ALE

2

Lithuania Verts/ALE

2

Luxembourg Verts/ALE

For (1)

1
icon: ECR ECR
62

Germany ECR

1

France ECR

Abstain (1)

1

Netherlands ECR

Against (1)

Abstain (2)

5

Romania ECR

Abstain (1)

1

Bulgaria ECR

2

Greece ECR

1

Croatia ECR

1

Slovakia ECR

Abstain (1)

1
icon: NI NI
36

Germany NI

For (1)

Abstain (1)

2

France NI

1

Netherlands NI

Against (1)

1

Romania NI

For (1)

1

Belgium NI

For (1)

1

Czechia NI

For (1)

1

Croatia NI

Abstain (1)

2

Slovakia NI

Abstain (1)

3

Latvia NI

Abstain (1)

1
icon: The Left The Left
32

Netherlands The Left

For (1)

1

Sweden The Left

For (1)

1

Belgium The Left

Abstain (1)

1

Czechia The Left

Abstain (1)

1

Denmark The Left

1

Ireland The Left

For (1)

4
icon: ID ID
46

Belgium ID

For (1)

3

Czechia ID

Against (1)

1

Austria ID

3

Denmark ID

For (1)

1

Estonia ID

Abstain (1)

1
AmendmentsDossier
714 2022/0272(COD)
2023/04/28 IMCO 291 amendments...
source: 746.662
2023/05/04 ITRE 423 amendments...
source: 746.920

History

(these mark the time of scraping, not the official date of the change)

docs/11
date
2024-03-12T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/TA-9-2024-0130_EN.html title: T9-0130/2024
type
Text adopted by Parliament, 1st reading/single reading
body
EP
events/9
date
2024-03-11T00:00:00
type
Debate in Parliament
body
EP
docs
url: https://www.europarl.europa.eu/doceo/document/CRE-9-2024-03-11-TOC_EN.html title: Debate in Parliament
events/10
date
2024-03-12T00:00:00
type
Decision by Parliament, 1st reading
body
EP
docs
url: https://www.europarl.europa.eu/doceo/document/TA-9-2024-0130_EN.html title: T9-0130/2024
forecasts
  • date: 2024-03-11T00:00:00 title: Indicative plenary sitting date
procedure/stage_reached
Old
Awaiting Parliament's position in 1st reading
New
Awaiting Council's 1st reading position
events/9
date
2024-03-11T00:00:00
type
Debate in Parliament
body
EP
docs
url: https://www.europarl.europa.eu/doceo/document/CRE-9-2024-03-11-TOC_EN.html title: Debate in Parliament
forecasts
  • date: 2024-03-11T00:00:00 title: Indicative plenary sitting date
events/9
date
2024-03-11T00:00:00
type
Debate in Parliament
body
EP
forecasts/0
date
2024-03-12T00:00:00
title
Vote scheduled
forecasts/0
date
2024-03-11T00:00:00
title
Indicative plenary sitting date
forecasts/0/title
Old
Indicative plenary sitting date
New
Debate scheduled
forecasts/1
date
2024-03-12T00:00:00
title
Vote in plenary scheduled
forecasts/0/title
Old
Indicative plenary sitting date
New
Debate in plenary scheduled
forecasts/1
date
2024-03-12T00:00:00
title
Vote in plenary scheduled
forecasts/0/title
Old
Indicative plenary sitting date
New
Debate in plenary scheduled
forecasts/1
date
2024-03-12T00:00:00
title
Vote in plenary scheduled
forecasts/0/title
Old
Indicative plenary sitting date
New
Debate in plenary scheduled
forecasts/1
date
2024-03-12T00:00:00
title
Vote in plenary scheduled
forecasts/0/title
Old
Indicative plenary sitting date
New
Debate in plenary scheduled
forecasts/1
date
2024-03-12T00:00:00
title
Vote in plenary scheduled
docs/10
date
2023-12-20T00:00:00
docs
url: https://www.europarl.europa.eu/RegData/commissions/itre/inag/2023/12-20/ITRE_AG(2023)758004_EN.docx title: PE758.004
type
Text agreed during interinstitutional negotiations
body
EP
events/8/docs
  • url: https://www.europarl.europa.eu/RegData/commissions/itre/inag/2023/12-20/ITRE_AG(2023)758004_EN.docx title: PE758.004
forecasts/0/date
Old
2024-04-10T00:00:00
New
2024-03-11T00:00:00
forecasts/0/date
Old
2024-03-11T00:00:00
New
2024-04-10T00:00:00
forecasts/0/date
Old
2024-04-10T00:00:00
New
2024-03-11T00:00:00
events/8
date
2024-01-23T00:00:00
type
Approval in committee of the text agreed at 1st reading interinstitutional negotiations
body
EP
docs/9
date
2023-12-20T00:00:00
docs
title: GEDA/A/(2024)000218
type
Coreper letter confirming interinstitutional agreement
body
CSL
forecasts/0/date
Old
2024-03-11T00:00:00
New
2024-04-10T00:00:00
forecasts
  • date: 2024-03-11T00:00:00 title: Indicative plenary sitting date
docs/3/docs/0/url
Old
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C:2022:452:TOC
New
https://eur-lex.europa.eu/oj/daily-view/L-series/EN/TXT/?uri=OJ:C:2022:452:TOC
docs/9/date
Old
2023-05-22T00:00:00
New
2023-05-23T00:00:00
docs/10/date
Old
2022-12-20T00:00:00
New
2022-12-21T00:00:00
docs/11/date
Old
2022-11-13T00:00:00
New
2022-11-14T00:00:00
docs/12/date
Old
2022-12-18T00:00:00
New
2022-12-19T00:00:00
events/7
date
2023-09-13T00:00:00
type
Committee decision to enter into interinstitutional negotiations confirmed by plenary (Rule 71)
body
EP
events/6
date
2023-09-11T00:00:00
type
Committee decision to enter into interinstitutional negotiations announced in plenary (Rule 71)
body
EP
docs/10
date
2022-12-20T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
PT_PARLIAMENT
docs/9
date
2023-07-27T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/A-9-2023-0253_EN.html title: A9-0253/2023
type
Committee report tabled for plenary, 1st reading/single reading
body
EP
events/5/summary
  • The Committee on Industry, Research and Energy adopted the report by Nicola DANTI (Renew, IT) on the proposal for a regulation of the European Parliament and of the Council on horizontal cybersecurity requirements for products with digital elements and amending Regulation (EU) 2019/1020.
  • The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:
  • Security updates
  • The amended text stated that manufacturers should ensure, where technically feasible, that products with digital elements clearly differentiate between security and functionality updates. Security updates, designed to decrease the level of risk or to remedy potential vulnerabilities, should be installed automatically , in particular in the case of consumer products.
  • Enhancing skills in a cyber resilient digital environment
  • Members stressed the importance of professional skills in the cybersecurity field, proposing education and training programmes, collaboration initiatives, and strategies for enhancing workforce mobility.
  • Point of single contact for users
  • In order to facilitate reporting on the security of products , manufacturers should designate a point of single contact to enable users to communicate directly and rapidly with them, where applicable by electronic means and in a user-friendly manner, including by allowing users of the product to choose the means of communication, which should not solely rely on automated tools.
  • Manufacturers should make public the information necessary for the end users to easily identify and communicate with their points of single contact.
  • Guidelines
  • The amended text included provisions for the Commission to issue guidelines to create clarity, certainty for, and consistency among the practices of economic operators. The Commission should focus on how to facilitate compliance by microenterprises, small enterprises and medium-sized enterprises.
  • Conformity assessment procedures for products with digital elements
  • Harmonised standards, common specifications or European cybersecurity certification schemes should be in place for six months before the conformity assessment procedure applies.
  • Mutual recognition agreements (MRAs)
  • To promote international trade, the Commission should endeavour to conclude Mutual Recognition Agreements (MRAs) with third countries. The Union should establish MRAs only with third countries that are on a comparable level of technical development and have a
  • compatible approach concerning conformity assessment. The MRAs should ensure the same level of protection as that provided for by this Regulation.
  • Procedure at EU level concerning products with digital elements presenting a significant cybersecurity risk
  • Where the Commission has sufficient reason to consider that a product with digital elements presents a significant cybersecurity risk in light of non-technical risk factors, Members considered that it should inform the relevant market surveillance authorities and issue targeted recommendations to economic operators aimed at ensuring that appropriate corrective actions are put in place.
  • Revenues generated from penalties
  • The revenues generated from the payments of penalties should be used to strengthen the level of cybersecurity within the Union, including by developing capacity and skills related to cybersecurity, improving economic operators' cyber resilience, in particular of microenterprises and of small and medium-sized enterprises and more in general fostering public awareness of cyber security issues.
  • Evaluation and review
  • Every year when presenting the Draft Budget for the following year, the Commission should submit a detailed assessment of ENISA's tasks under this Regulation as set out in Annex VIa and other relevant Union law and shall detail the financial and human resources needed to fulfil those tasks.
docs/9
date
2023-07-27T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/A-9-2023-0253_EN.html title: A9-0253/2023
type
Committee report tabled for plenary, 1st reading/single reading
body
EP
events/5/docs
  • url: https://www.europarl.europa.eu/doceo/document/A-9-2023-0253_EN.html title: A9-0253/2023
events/5
date
2023-07-27T00:00:00
type
Committee report tabled for plenary, 1st reading
body
EP
procedure/stage_reached
Old
Awaiting committee decision
New
Awaiting Parliament's position in 1st reading
events/3
date
2023-07-19T00:00:00
type
Vote in committee, 1st reading
body
EP
events/4
date
2023-07-19T00:00:00
type
Committee decision to open interinstitutional negotiations with report adopted in committee
body
EP
procedure/Other legal basis
Rules of Procedure EP 159
docs/8
date
2023-06-30T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/IMCO-AD-742490_EN.html title: PE742.490
committee
IMCO
type
Committee opinion
body
EP
docs/8
date
2023-05-22T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
NL_SENATE
docs/7
date
2023-05-03T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/ITRE-AM-746921_EN.html title: PE746.921
type
Amendments tabled in committee
body
EP
docs/6
date
2023-05-03T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/ITRE-AM-746920_EN.html title: PE746.920
type
Amendments tabled in committee
body
EP
committees/2/opinion
False
events/2
date
2023-04-20T00:00:00
type
Referral to associated committees announced in Parliament
body
EP
procedure/legal_basis/0
Rules of Procedure EP 57
docs/5
date
2023-03-31T00:00:00
docs
url: https://www.europarl.europa.eu/doceo/document/ITRE-PR-745538_EN.html title: PE745.538
type
Committee draft report
body
EP
procedure/Legislative priorities/0/title
Old
Joint Declaration on EU legislative priorities for 2023 and 2024
New
Joint Declaration 2023-24
procedure/Legislative priorities/0
title
Joint Declaration on EU legislative priorities for 2023 and 2024
url
https://oeil.secure.europarl.europa.eu/oeil/popups/thematicnote.do?id=41380&l=en
committees/0/shadows/3
name
GAZZINI Matteo
group
Identity and Democracy
abbr
ID
docs/4
date
2022-12-14T00:00:00
docs
url: https://dmsearch.eesc.europa.eu/search/public?k=(documenttype:AC)(documentnumber:4103)(documentyear:2022)(documentlanguage:EN) title: CES4103/2022
type
Economic and Social Committee: opinion, report
body
ESC
committees/0/shadows/4
name
BOTENGA Marc
group
The Left group in the European Parliament - GUE/NGL
abbr
GUE/NGL
committees/1
Old
type
Committee Opinion
body
EP
committee_full
Civil Liberties, Justice and Home Affairs
committee
LIBE
associated
False
New
type
Committee Opinion
body
EP
committee_full
Internal Market and Consumer Protection
committee
IMCO
associated
False
rapporteur
name: LØKKEGAARD Morten date: 2022-12-16T00:00:00 group: Renew Europe group abbr: Renew
committees/2
Old
type
Committee Opinion
body
EP
committee_full
Internal Market and Consumer Protection
committee
IMCO
associated
False
rapporteur
name: LØKKEGAARD Morten date: 2022-12-16T00:00:00 group: Renew Europe group abbr: Renew
New
type
Committee Opinion
body
EP
committee_full
Civil Liberties, Justice and Home Affairs
committee
LIBE
associated
False
docs/4
date
2022-11-13T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
CZ_CHAMBER
docs/4
date
2022-12-18T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
BG_PARLIAMENT
docs/0
date
2022-09-15T00:00:00
docs
summary
type
Legislative proposal
body
EC
events/0
date
2022-09-15T00:00:00
type
Legislative proposal published
body
EC
docs
summary
committees/1/rapporteur
  • name: LØKKEGAARD Morten date: 2022-12-16T00:00:00 group: Renew Europe group abbr: Renew
docs/0
date
2022-09-15T00:00:00
docs
summary
type
Legislative proposal
body
EC
events/0
date
2022-09-15T00:00:00
type
Legislative proposal published
body
EC
docs
summary
committees/0
type
Responsible Committee
body
EP
committee_full
Industry, Research and Energy
committee
ITRE
associated
False
rapporteur
name: DANTI Nicola date: 2022-10-26T00:00:00 group: Renew Europe group abbr: Renew
shadows
committees/0
type
Responsible Committee
body
EP
committee_full
Industry, Research and Energy
committee
ITRE
associated
False
rapporteur
name: DANTI Nicola date: 2022-10-26T00:00:00 group: Renew Europe group abbr: Renew
shadows
docs/3
date
2022-11-09T00:00:00
docs
type
Document attached to the procedure
body
EDPS
docs/3
date
2022-11-13T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
CZ_CHAMBER
docs/3
date
2022-11-13T00:00:00
docs
url: https://connectfolx.europarl.europa.eu/connefof/app/exp/COM(2022)0454 title: COM(2022)0454
type
Contribution
body
CZ_CHAMBER
events/1
date
2022-11-09T00:00:00
type
Committee referral announced in Parliament, 1st reading
body
EP
procedure/dossier_of_the_committee
  • ITRE/9/10122
procedure/stage_reached
Old
Preparatory phase in Parliament
New
Awaiting committee decision
commission
  • body: EC dg: Communications Networks, Content and Technology commissioner: BRETON Thierry
committees/0/shadows/2
name
CORRAO Ignazio
group
Group of the Greens/European Free Alliance
abbr
Verts/ALE
procedure/Legislative priorities
  • title: Joint Declaration 2022 url: https://oeil.secure.europarl.europa.eu/oeil/popups/thematicnote.do?id=41360&l=en
procedure/title
Old
Horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act)
New
Cyber Resilience Act
committees/0/rapporteur
  • name: DANTI Nicola date: 2022-10-26T00:00:00 group: Renew Europe group abbr: Renew
committees/0/shadows/0
name
VIRKKUNEN Henna
group
Group of European People's Party
abbr
EPP
committees/0/shadows
  • name: KAILI Eva group: Group of Progressive Alliance of Socialists and Democrats abbr: S&D
  • name: TOŠENOVSKÝ Evžen group: European Conservatives and Reformists Group abbr: ECR
docs/0/docs/0
url
https://eur-lex.europa.eu/smartapi/cgi/sga_doc?smartapi!celexplus!prod!DocNumber&lg=EN&type_doc=SECfinal&an_doc=2022&nu_doc=0321
title
EUR-Lex
docs/0
date
2022-09-15T00:00:00
docs
type
Legislative proposal
body
EC
events/0/summary
  • PURPOSE: to lay down a horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements.
  • PROPOSED ACT: Regulation of the European Parliament and of the Council.
  • ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.
  • BACKGROUND: hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of EUR 5.5 trillion by 2021. Such products suffer from two major problems adding costs for users and the society: (i) a low level of cybersecurity , reflected by widespread vulnerabilities and the insufficient and inconsistent provision of security updates to address them, and (ii) an insufficient understanding and access to information by users, preventing them from choosing products with adequate cybersecurity properties or using them in a secure manner. In a connected environment, a cybersecurity incident in one product can affect an entire organisation or a whole supply chain, often propagating across the borders of the internal market within a matter of minutes. This can lead to severe disruption of economic and social activities or even become life threatening.
  • While the existing Union legislation applies to certain products with digital elements, there is no horizontal Union regulatory framework establishing comprehensive cybersecurity requirements for all products with digital elements. It is therefore necessary to lay down a uniform legal framework for essential cybersecurity requirements for placing products with digital elements on the Union market.
  • CONTENT: with this proposal, the Commission seeks to lay down horizontal cybersecurity rules which are not specific to sectors or certain products with digital elements.
  • Subject matter
  • Based on the new legislative framework for product legislation in the EU, the proposal establishes:
  • - rules for the placing on the market of products with digital elements to ensure the cybersecurity of such products;
  • - essential requirements for the design, development and production of products with digital elements, and obligations for economic operators in relation to these products with respect to cybersecurity;
  • - essential requirements for the vulnerability handling processes put in place by manufacturers to ensure the cybersecurity of products with digital elements during the whole life cycle, and obligations for economic operators in relation to these processes;
  • - rules on market surveillance and enforcement of the above-mentioned rules and requirements.
  • Scope
  • The draft Regulation applies to products with digital elements whose intended or reasonably foreseeable use includes a direct or indirect logical or physical data connection to a device or network. It will not apply to products for which cybersecurity requirements are already set out in existing EU rules, for example on medical devices, aviation or cars .
  • Objectives
  • It has two main objectives aiming to ensure the proper functioning of the internal market:
  • - create conditions for the development of secure products with digital elements by ensuring that hardware and software products are placed on the market with fewer vulnerabilities and that manufactures take security seriously throughout a product’s life cycle;
  • - create conditions allowing users to take cybersecurity into account when selecting and using products with digital elements.
  • Obligations for manufacturers, importers and distributors
  • Obligations would be set up for economic operators, starting from manufacturers, up to distributors and importers, in relation to the placement on the market of products with digital elements, as adequate for their role and responsibilities on the supply chain.
  • The essential cybersecurity requirements and obligations mandate that all products with digital elements shall only be made available on the market if, where dully supplied, properly installed, maintained and used for their intended purpose or under conditions, which can be reasonably foreseen, they meet the essential cybersecurity requirements set out in this draft Regulation.
  • The essential requirements and obligations would mandate manufacturers to factor in cybersecurity in the design and development and production of the products with digital elements, exercise due diligence on security aspects when designing and developing their products, be transparent on cybersecurity aspects that need to be made known to customers, ensure security support (updates) in a proportionate way, and comply with vulnerability handling requirements.
  • Notification of conformity assessment bodies
  • Proper functioning of notified bodies is crucial for ensuring a high level of cybersecurity and for the confidence of all interested parties. Therefore, the proposal sets out requirements for national authorities responsible for conformity assessment bodies (notified bodies). Member States will designate a notifying authority that will be responsible for setting up and carrying out the necessary procedures for the assessment and notification of conformity assessment bodies and the monitoring of notified bodies.
  • Conformity assessment process
  • Manufacturers should undergo a process of conformity assessment to demonstrate whether the specified requirements relating to a product have been fulfilled. Where compliance of the product with the applicable requirements has been demonstrated, manufacturers and developers would draw up an EU declaration of conformity and will be able to affix the CE marking.
  • Market surveillance
  • Member States should appoint market surveillance authorities , which would be responsible for enforcing the Cyber Resilience Act obligations.
  • In case of non-compliance, market surveillance authorities could require operators to bring the non-compliance to an end and eliminate the risk, to prohibit or restrict the making available of a product on the market, or to order that the product is withdrawn or recalled. Each of these authorities will be able to fine companies that don't adhere to the rules.
  • Application
  • To allow manufacturers, notified bodies and Member States time to adapt to the new requirements, the proposed Regulation will become applicable 24 months after its entry into force, except for the reporting obligation on manufacturers, which would apply from 12 months after the date of entry into force.